How to build a defensible investigation chronology
Learn how to create an investigation chronology that separates events from analysis and keeps every important entry tied to its source.
A useful investigation chronology is more than a sorted list of dates. It is a source-linked model of what is known, what is disputed, what remains uncertain, and what should happen next. Built carefully, it supports analysis without quietly turning assumptions into facts.
Key takeaways
- Keep event date, record date, and date precision separate.
- Tie every material entry to a source and preserve the source in its original context.
- Record competing accounts and analytical observations without overwriting the factual layer.
Start with an event model
Define the fields before adding hundreds of entries. A practical event record contains an event date or date range, time zone where relevant, description, people or organizations involved, location, source reference, confidence or verification state, issue tags, and the person who added or changed the entry.
Store the date on which a statement or document was created separately from the date of the event it describes. A witness statement signed in September may describe an event in June. Combining those dates produces a misleading sequence.
- Use exact, approximate, before, after, and date-range precision deliberately
- Preserve original time zones and record normalized times separately
- Avoid inventing a day or time simply to make sorting easier
- Flag inferred dates visibly and explain the basis for the inference
Write neutral event descriptions
Chronology entries should describe the source before they argue the case. Prefer a formulation such as 'Email from A to B states…' over a conclusion that presents the email's claim as established fact. If two sources conflict, create separate source-linked entries or record the conflict explicitly.
Keep analytical notes in a distinct field or layer. Investigators need hypotheses, issue spotting, and credibility assessments, but a later reviewer must be able to distinguish those judgments from the underlying record.
Make provenance visible
Every important entry should lead back to the document, interview, system record, photograph, or item that supports it. Use stable identifiers rather than filenames alone. If a source is replaced or corrected, retain the history and explain why the preferred version changed.
For digital evidence, preservation may require additional controls such as documenting acquisition, recording hashes, restricting access to originals, and keeping examination copies separate. The appropriate method depends on the evidence, tools, legal authority, and applicable procedure.
Review the chronology as a control tool
A chronology should expose gaps rather than hide them. Filter for periods with no evidence, events supported by a single source, uncertain identities, unexplained transfers, and deadlines arising from the record. Record follow-up actions separately so the factual history does not become a task list.
Before reporting, test whether another authorized investigator can reproduce the important sequence from the cited sources. Resolve broken references and make uncertainty explicit instead of smoothing the narrative after the fact.
What is the difference between an investigation chronology and a case summary?
An investigation chronology organizes source-supported events in time. A case summary explains the current understanding of the matter, often grouping events by issue rather than date. Maintain the chronology as the supporting record and link the summary back to material entries. A concise summary can omit detail for readability; the chronology should preserve the date uncertainty, competing accounts, and source references needed to examine that detail.
Define the investigation question before entering records. An employment investigation may focus on communications and decisions, while an asset investigation may need movements, ownership changes, and transaction dates. Record relevant events consistently and explain the scope of collection so that an apparent gap is not mistaken for proof that nothing happened.
Example chronology entry with conflicting dates
In a fictional investigation, an email sent on 12 March says that a meeting took place on 10 March. A later interview places the meeting on 11 March. Record the email's creation date separately from the event it describes. Link both sources to the disputed meeting, identify the conflicting dates, and assign a follow-up to check an independent record if one is available and lawfully accessible.
A neutral entry could read: 'Meeting reported as taking place on 10 or 11 March; date disputed between email E-014 and interview note I-003.' Keep any provisional sorting date visibly marked as provisional. Record the time zone when a precise time matters, especially when participants, devices, or services are in different locations.
- Event identifier, description, and issue addressed
- Event date or date range, precision, and time zone
- Source identifier with page, message, or passage reference
- Conflicting account and the reason the date remains uncertain
- Entry author, review status, and next verification action
How should corrections and missing evidence be handled?
Correct an error without hiding how the earlier entry was reached. Keep the previous wording or an amendment history, explain the reason for the correction, and identify the new source. If a change affects an existing report or decision, flag the downstream work for review. Exported chronologies should carry a version or preparation date so readers know which record they received.
Treat a missing document, an unreadable scan, and a source that was never collected as different conditions. Record searches and limitations before describing a period as having no relevant activity. A chronology supports defensibility through transparent handling and review; its format alone does not establish the truth of an account or determine admissibility.